CVE-2019-12170

ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.

• CWE-434

• http://incidentsecurity.com/atutor-2-2-4-backup-remote-command-execution/Exploit, Third Party Advisory, URL Repurposed
• http://packetstormsecurity.com/files/153869/ATutor-2.2.4-Backup-Remote-Command-Execution.html
• https://github.com/fuzzlove/ATutor-Instructor-Backup-Arbitrary-FileExploit, Third Party Advisory
• http://incidentsecurity.com/atutor-2-2-4-backup-remote-command-execution/Exploit, Third Party Advisory, URL Repurposed
• http://packetstormsecurity.com/files/153869/ATutor-2.2.4-Backup-Remote-Command-Execution.html
• https://github.com/fuzzlove/ATutor-Instructor-Backup-Arbitrary-FileExploit, Third Party Advisory

Published

May 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12164ubuntu-server.js in Status React Native Desktop before v0.57…
• CVE-2019-12165MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and…9.8
• CVE-2019-12167httpGetSet/httpGet.htm on Emerson Network Power Liebert Chal…
• CVE-2019-12168Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow r…
• CVE-2019-12169ATutor 2.2.4 allows Arbitrary File Upload and Directory Trav…8.8
• CVE-2019-1217A remote code execution vulnerability exists in the way that…7.5
• CVE-2019-12171Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) i…
• CVE-2019-12172Typora 0.9.9.21.1 (1913) allows arbitrary code execution via…
• CVE-2019-12173MacDown 0.7.1 (870) allows remote code execution via a file:…
• CVE-2019-12174hide.me before 2.4.4 on macOS suffers from a privilege escal…
• CVE-2019-12175In Zeek Network Security Monitor (formerly known as Bro) bef…
• CVE-2019-12176Privilege escalation in the "HTC Account Service" and "Vivep…